Siemens RF680R Error 0xE2FE81: Extracting EPC-ID from 620T Tags

1. Problem Overview

An S7-1516F-3 PN/DP controller polls a SIMATIC RF680R UHF reader to identify multiple RF620T transponders. After running an inventory (Read EPC) the program passes the captured ID back into a follow-up Read_User_Data call against the same tag. The IDENT block returns status word 0xE2FE81 on every cycle:

"There is no transponder with the required EPC-ID in the transmission window or there is no transponder at all in the antenna field."

The antenna is verified to be live, the transponder is physically present, and the initial EPC read returns plausible bytes. Yet the second IDENT call never sees the tag. The root cause is almost always a malformed EPC-ID buffer, not a missing tag.

2. Affected Hardware and Firmware

Reference documentation: SIMATIC RF650R/RF680R/RF685R Programming Manual (Siemens Support, PDF).

3. Decoding Error Code 0xE2FE81

Siemens RFID function blocks return a 32-bit STATUS word. The upper half encodes the function set (e.g. E2FE = standard Read/Write / Inventory family), the lower byte is the cause:

The condensed code 0xE2FE81 in the SCL source is the lower 24 bits; bit 0 is the "done/err" qualifier. In practice you will see the lower-byte enumerator change between 0x02 and 0xFF depending on why the IDENT block failed. For the case described here the lower byte reports 0x02 (UID_MISMATCH) — the tag is present, the EPC buffer the PLC sent is not what the air protocol heard.

4. EPC Memory Layout of the RF620T

The RF620T is a UHF Class 1 Gen 2 inlay with the following logical memory structure:

When the IDENT "Inventory" FB reports an EPC back to the PLC, the payload layout depends on which FB generated the data:

• Ident_Profile / Read with LEN_ID := 16#0C — only the 12 EPC bytes are placed in the user array.
• Ident_Profile / Read_UID with EPC filter — buffer starts with two length-prefix bytes (LSB first) followed by the EPC bytes.
• Generic Inventory FB with multiple tags — the response is wrapped in a TLV-style frame (Tag-Count byte, then per-tag records: LenL LenH EPC[0..n] CRC[0..1]).

If the program indexes the wrong region, the EPC-ID handed to the next Read call will silently include the length prefix, the CRC, or the TID — none of which will ever match a live tag in the air protocol.

5. The epcIDread[] Array — What's Really Inside

The user-supplied code treats epcIDread[] as a flat 12-byte EPC array:

ADDR_TAG := 16#0;
LEN_DATA := 16#A;
LEN_ID   := epcIDread[2];  -- expects 0x0C
EPCID_UID := epcIDread[];  -- expects 12 raw bytes

That is only correct when the underlying FB was a single-tag Read EPC. With the default "Read_UID" or "Inventory" configuration, the actual byte map is:

By assigning the entire epcIDread[] to EPCID_UID the program ships a 12-byte buffer that begins with the length prefix and ends two bytes short of the real EPC. The reader dutifully tries to match that string against the air protocol and reports 0xE2FE8102 — UID mismatch.

6. Root Cause: Buffer Framing Not Stripped

The IDENT block family never assumes the application buffer is the raw EPC. The TIA Portal help text for Read_UID explicitly states:

"The EPC-ID to be read is transferred to the input parameter. The buffer must contain only the EPC-ID, without length, header, or CRC."

Two structural mistakes commonly produce 0xE2FE81 with the RF680R/RF620T pair:

1. Passing the source array by reference instead of by value. The destination shares the same starting offset as the source; both blocks then receive the same frame header.
2. Using a dynamic LEN_ID from the wrong index. epcIDread[2] is the EPC MSB (the tag's manufacturer code, e.g. 0xE2 for Siemens), not a length byte. A valid 96-bit EPC always has LEN_ID = 12; the code should hard-code it.

7. Correct EPC-ID Extraction (SCL)

Strip the two-byte length prefix before passing the EPC to the next IDENT call. For a 12-byte EPC on the RF620T the canonical extraction looks like this:

// epcIDraw : ARRAY[0..15] OF BYTE  -- raw reader response
// EPCID    : ARRAY[0..11] OF BYTE  -- clean 12-byte EPC-ID
// LEN_EPC  : INT                   -- actual length, read from raw[0..1]

#LEN_EPC := WORD_TO_INT(    WORD#16#0000
                          OR SHL(INT_TO_WORD(#epcIDraw[0]), 0)
                          OR SHL(INT_TO_WORD(#epcIDraw[1]), 8) );

// Length prefix occupies epcIDraw[0..1]; EPC starts at index 2.
FOR #i := 0 TO 11 DO
    #EPCID[#i] := #epcIDraw[#i + 2];
END_FOR;

// Defensive clamp -- RF620T always reports 12.
IF #LEN_EPC > 12 THEN
    #LEN_EPC := 12;
END_IF;

Then drive the IDENT Read FB with the cleaned buffer:

"Ident_Read_DB"(  EPC_ID       := #EPCID,   // 12 clean bytes
                  LEN_ID       := 12,        // 0x0C hard-coded
                  ADDR_TAG     := 16#0000_0300,  // User memory bank 11, word 0
                  LEN_DATA     := 64,
                  DATA         := #userBuf,
                  CMD          := FALSE,
                  ... );

The word address 16#0300 targets User bank on Gen 2: bank bits in the upper nibble (3 = binary 11 = User), word address zero in the lower 16 bits. For EPC bank use 16#0200, for TID use 16#0000 (bank 10 requires bit-3 of the address word per EPCglobal spec).

8. Project Configuration Checklist

1. Reader firmware ≥ V4.0 for RF680R. V4.x adds ISO 18000-63 dual-mode and stable EPC filtering. Open the Web Based Management (WBM) of the reader at https://<reader-IP> and confirm in Settings → Device → Firmware.
2. Assign the Ident profile in the device configuration: Properties → Ident → Profile = "Ident profile V5.2". The standard "FB45-compatible" profile behaves slightly differently on LEN_ID handling.
3. Configure the antenna port — RF680R has four ports. Confirm the antenna cable terminator is fitted on unused ports (Settings → Antennas → Ant n → Terminated). An unterminated port can mask reads and produce intermittent 0xE2FE81/0xFF transitions.
4. Set the air protocol density to "Single Tag Read" for the application cycle: Settings → Air Protocol → Q-Value. With multiple 620T tags in the field, set Q = 4 (default) or use "Multi-Tag Read" mode if the application must inventory more than one tag per cycle.
5. PLC tag types: declare EPCID as ARRAY[0..11] OF BYTE. Do not use STRING, DWORD, or WSTRING — the IDENT block reads raw bytes, and the LEN_ID parameter assumes a byte count.
6. Cycle timing: the RF680R inventory round-trip is typically 80–250 ms per tag at full power. Insert a 300 ms debounce between successive IDENT Read calls on the same EPC to avoid saturating the air interface.

9. Using the WBM Tag Monitor for Verification

The RF680R Web Based Management includes a diagnostic page that lets an engineer confirm EPC visibility independent of the PLC program:

1. Open the WBM in a browser, log in with the engineering account.
2. Navigate to Diagnostics → Tag Monitor.
3. Tick Continuous to log every observed transponder.
4. Tick the antenna channels of interest (Ant 1 .. Ant 4).
5. Trigger the reader with a 620T in the field. The EPC, RSSI, and timestamp will be recorded.

Compare the EPC shown in the WBM with the buffer the PLC program is sending. They must match byte-for-byte, including MSB-first order. If the WBM reports E200 3411 B802 0117 6021 0085 and the PLC sends 0C 00 E2 00 34 11 ..., the PLC is still shipping the two-byte length prefix.

10. Verification Procedure

1. After downloading the corrected project to the S7-1516F, force the inventory FB once and watch epcIDraw in the watch table. Bytes 0–1 should read 0C 00, bytes 2–13 should be the EPC.
2. Inspect the populated EPCID after the extraction loop. It should match the WBM Tag Monitor output exactly.
3. Trigger the IDENT Read with the cleaned buffer. The STATUS should resolve to 16#0000_0000 on success, or 16#E2FE_8101 only if the tag is genuinely out of the field.
4. Repeat the cycle for every unique EPC you need to address. For applications with dozens of tags, store the cleaned EPCs in a ARRAY[0..n, 0..11] OF BYTE user DB and rotate through them with a sequencer.
5. Run a 24-hour soak test with the application cycle in automatic mode. Log any non-zero STATUS to a diagnostic DB and check for recurrence of 0xE2FE81 — if it reappears, the remaining cause is almost always an RF-coverage gap, not a buffer framing problem.

11. Common Pitfalls and Field Notes

Performance note: the RF680R with a 620T tag typically returns EPC at 60–90 reads/s in dense-reader mode, dropping to 20–30 reads/s in regulatory ETSI mode (Europe). If you see 0xE2FE81 only at high cycle rates, raise the dwell time on the IDENT block to ≥ 80 ms before declaring a buffer error.

Safety note: the RF680R radiates UHF at ≤ 2 W ERP (region-dependent). When you set up antenna bench tests in development, fit RF-absorbing material around the test area; reflective surfaces can produce standing-wave nulls that look exactly like a "no transponder" fault.

12. Key Takeaways

• 0xE2FE81 is a UID-mismatch class error, not an "antenna is dead" error. The tag is most likely in the field — your buffer is wrong.
• On the RF620T the EPC is always 12 bytes. Hard-code LEN_ID = 16#0C; never derive it from the response.
• Strip the two length-prefix bytes (epcIDraw[0..1]) before forwarding the EPC to a subsequent IDENT Read.
• Validate against the WBM Tag Monitor first. If the WBM and PLC disagree on the EPC bytes, the PLC framing is the problem.
• The Tag Monitor "stopping" is a circular-buffer feature, not a fault.

For full block diagrams, antenna patterns, and the complete error-code catalogue, refer to the SIMATIC RF650R/RF680R/RF685R Programming Manual on Siemens Industry Online Support.